Remote access to Management Console (Hacking attack)

[Hayward-i1]

Potential hacking attack against the management console remotely.

I have been checking the Windows event viewer and noticed a warning messages appearing from a source of "3CXManagementConsole"

It reads

Category: ManagementConsoleJS.Controllers.LoginController
EventId: 0
SpanId: 7a7378af5c4e9e8b
TraceId: a9c7f36ab61d0d5c348dec92503f2d69
ParentId: 0000000000000000
ConnectionId: 0HN7OLH4AVUQF
RequestId: 0HN7OLH4AVUQF:00000001
RequestPath: /webclient/api/Login/GetAccessToken
ActionId: 23dcdcbe-d0d0-475f-85d7-c11629e63aeb
ActionName: ManagementConsoleJS.Controllers.LoginController.GetAccessToken (3CXManagementConsole)

LoginException: User or password is invalid from (136.158.119.124)

-----oOo-----

Clearly it looks like someone is trying to gain unauthorized access to my 3cx installation from a remote site.

The message is appearing approximately 1 every 10ish minutes from different IPs.

Worryingly there is nothing in the 3cx event log or activity log, it is only showing the the Windows event manager log..

So 2 questions.

Firstly and most importantly, How do I close remote access to the management console (that is access from outside the local LAN)? If there is no "limit remote access to the management console" in 3CX, I will close the appropriate port in the firewall, but what port do I need to close?

Secondly, how come such an important security problem is not more visible as part of the management function in 3CX i.e. as part of the event or activity logs. Looking in the windows event viewer is a very strange place to put such an important event.

 

[Alejandro_3CX]

Hi you may restrict the PBX admin console by adding the trusted static public IP, users trying to login remote using different IPs will still access the web client but without access to the admin console.

If you are not using any external service that requires the HTTPS port then you can close the port, otherwise try to implement the console restriction or as alternative an access list in the firewall instead.

For more information about how to secure your system take a look in our 3cx Academy where we have a chapter dedicated to the security and anti-Hacking.

Have a great day!